@clawos-dev/clawd@0.2.243: Suspicious npm security report (Warn)

Loading npm security reports…

@clawos-dev/clawd@0.2.243: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged

dist/dispatch/mcp-server.cjsView file

39524// src/tools/claude.ts L39525: var import_node_child_process = require("child_process"); L39526: var import_node_child_process2 = require("child_process");

High

Child Process

Package source references child process execution.

dist/dispatch/mcp-server.cjsView on unpkg · L39524

39511const json = serializeMessage(message); L39512: if (this._stdout.write(json)) { L39513: resolve(); ... L39521: // src/dispatch/mcp-server.ts L39522: var import_undici = __toESM(require_undici(), 1); L39523: L39524: // src/tools/claude.ts L39525: var import_node_child_process = require("child_process"); L39526: var import_node_child_process2 = require("child_process");

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dispatch/mcp-server.cjsView on unpkg · L39511

dist/peer-ops/mcp-server.cjsView file

2943sourceCode = this.opts.code.process(sourceCode, sch); L2944: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2945: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/peer-ops/mcp-server.cjsView on unpkg · L2943

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1679 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/cli.cjsView file

•path = dist/cli.cjs kind = oversized_source_file sizeBytes = 2284779 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.cjsView on unpkg

•path = dist/cli.cjs kind = oversized_cli_entrypoint sizeBytes = 2284779 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.cjsView on unpkg

Source & flagged code

7 flagged · loading source

dist/dispatch/mcp-server.cjsView file

39524// src/tools/claude.ts L39525: var import_node_child_process = require("child_process"); L39526: var import_node_child_process2 = require("child_process");

High

Child Process

Package source references child process execution.

dist/dispatch/mcp-server.cjsView on unpkg · L39524

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dispatch/mcp-server.cjsView on unpkg · L39511

dist/peer-ops/mcp-server.cjsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/peer-ops/mcp-server.cjsView on unpkg · L2943

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1679 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/cli.cjsView file

•path = dist/cli.cjs kind = oversized_source_file sizeBytes = 2284779 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.cjsView on unpkg

•path = dist/cli.cjs kind = oversized_cli_entrypoint sizeBytes = 2284779 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.cjsView on unpkg

Source & flagged code

7 flagged

dist/dispatch/mcp-server.cjsView file

39524// src/tools/claude.ts L39525: var import_node_child_process = require("child_process"); L39526: var import_node_child_process2 = require("child_process");

High

Child Process

Package source references child process execution.

dist/dispatch/mcp-server.cjsView on unpkg · L39524

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dispatch/mcp-server.cjsView on unpkg · L39511

dist/peer-ops/mcp-server.cjsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/peer-ops/mcp-server.cjsView on unpkg · L2943

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1679 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/cli.cjsView file

•path = dist/cli.cjs kind = oversized_source_file sizeBytes = 2284779 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.cjsView on unpkg

•path = dist/cli.cjs kind = oversized_cli_entrypoint sizeBytes = 2284779 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.cjsView on unpkg

@clawos-dev/clawd@0.2.243

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code